changedetection.io EUVD-2026-84604

Exploitation requires: (1) an authenticated changedetection.io user (PR:L) who adds or monitors an attacker-controlled/compromised web page; (2) that page containing an HTML element whose id includes an XSS payload with quote/angle-bracket characters that survives into the fallback xpath builder (the id must be non-unique so findUpTag() falls through to the id path per the added test); and (3) the victim opening the Visual Selector component (UI:P/UI:R), which renders the stored selector id via innerHTML. It affects changedetection.io versions up to 0.55.8; the payload executes only in the victim user's own browser context with limited integrity impact, and there is no direct unauthenticated path - these authentication and interaction requirements meaningfully limit real-world risk.

This is a genuinely low-priority issue despite a public exploit, and the signals largely agree. The vendor CVSS 4.0 score is only 2.0 with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N - network reachable but requiring an authenticated user (PR:L) and passive user interaction (UI:P), with only limited integrity impact and no confidentiality or availability impact. The XSS is DOM-based and fires in the Visual Selector when it renders a scraped element id via innerHTML, so the malicious payload originates from the attacker-controlled watched web page, not from a direct request to changedetection.io - this indirection is why complexity/impact stay low. POC availability (VulDB, GitHub) and the CVSS 4.0 exploit-maturity flag E:P (proof-of-concept) are confirmed, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation; POC existence must not be conflated with in-the-wild use. The patch is confirmed (commit aac6fcfa, PR #4282, release 0.60.1), replacing innerHTML with textContent and stripping quote/angle-bracket characters from xpath ids. Net: real but minor, self-inflicted-leaning XSS bounded by authentication and required interaction - routine patching priority, not urgent.

An attacker sets up (or compromises) a web page containing an element whose id embeds an XSS payload such as dupe"><img src=x onerror=...>, then induces or waits for a changedetection.io user to monitor that URL and open the Visual Selector, where the unsanitized id is written to the DOM via innerHTML and executes in the user's browser session. A public proof-of-concept exists (VulDB and a GitHub PoC repo), and the source diff confirms the sink and fix.